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tC ' Abstract 

We consider a major family of quantum algorithms. Bob chooses a 
function out of a set of functions and gives Ahce the black box that com- 
jrt ■ putes it. Alice is to find a characteristic of the function chosen by Bob (e. 

'~{ I g. the period) by performing function evaluation for different values of 

^^. the argument. The time-symmetric representation of these quantum al- 

gorithms shows that: (i) the characteristic of the function found by Alice 
is a by-product of her reconstruction of Bob's choice and (ii) since there 
is maximal quantum correlation between Bob's choice and Alice's recon- 
^b ' struction of it, all is as if Alice by reading the reconstruction at the end of 

f^ , the algorithm determined half of Bob's choice. This quantum retroaction 

^\ • of the output on the input explains why quantum algorithms create a 

L~:> ' stronger than classical input-output correlation, viz. the quantum speed- 

up. This explanation allows us to pinpoint the exact mechanism of the 
^— ^ ■ quantum speed-up. Given a set of functions, this mechanism - under max- 

imization of a quantity of information - becomes the quantum algorithm 
that yields a characteristic of the function chosen by Bob. This should be 
a break through, until now there was no known mechanism for producing 
quantum speed-ups. 

X: 

5^! 1 Foreword 

We propose an explanation of the mechanism underlying the quantum speed-up 
- quantum algorithms requiring fewer computation steps than the corresponding 
classical algorithms. 

We try and position the present proposal within state of the art. It is fair 
to say that, twenty-seven years after the discovery of the seminal quantum al- 
gorithm on the part of Deutsch [1], there is not yet an exact explanation of 
the mechanism of the quantum speed-up. By this we mean a precise descrip- 
tion of the entire mechanism that produces the speed-up. For example, the 
notion of quantum parallel computation, although has inspired all the quantum 



algorithms found so far, cannot be considered the description of a mechanism. 
It only says that the simultaneous computation of a quantum superposition of 
inputs and quantum interference are essential ingredients of the speed-up. Al- 
though various relations between speed-up and other special quantum features, 
like entanglement and discord, have been pinpointed in special situations, none 
of them can be considered a description of the full mechanism of the speed-up. 

A related problem still requiring an answer is that of the fundamental nature 
of the speed up. Apropos of this, it is important to note that some quantum 
algorithms, like the seminal Deutsch's algorithm and Grover's [2] algorithm, 
require fewer computation steps than the minimum demonstrably required in 
the classical case. Now, there is a striking contrast between the amount of 
literature produced on the quantum violation of limits applying to classical 
processes like Bell's inequalities and no literature at all on the same kind of 
violation on the part of quantum computation. 

The present explanation of the speed-up relies on the time-symmetric [3] 
quantum mechanics of Aharonov et al. - see also Vaidman's update of this 
theory [4] - and on the retro-causal nature of quantum measurement highlighted 
by partial measurement, as from the work of Dolev and Elitzur [5] on the non- 
sequential behavior of the wave function. 

2 Summary 

We consider an important family of quantum algorithms. Bob chooses a function 
out of a set of functions and gives Alice the black box that computes it. Alice 
is to find a characteristic of the function chosen by Bob by performing function 
evaluation for different values of the argument. 

Let us focus on a simple example of speed-up. Bob hides a ball in one of 
four drawers. Alice is to locate it by trying different drawers. If the algorithm is 
classical, to be sure of locating the ball, Alice should plan to open three drawers. 
In Grover's quantum algorithm [2], only one drawer suffices, what is obviously 
the quantum violation of a classical limit. 

The time-symmetric representation of these quantum algorithms requires 
the physical representation of both Alice's action of solving the problem and 
Bob's action of setting the problem (e. g. by choosing the number of the 
drawer with the ball) . In this representation, the quantum process is considered 
in its canonical entirety - initial measurement, unitary transformation, final 
measurement. See Figure 1, where S. stands for state, M. for measurement, U 
is the unitary part of the quantum algorithm. 
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Quantum correlation, reading the output contributes to determining the input. 

Fig. 1 Time-symmetric representation of quantum algorithms 



As we will see, this representation highlights the quantum correlation exist- 
ing between Bob's choice and the solution found by Alice - see the dotted line 
in the figure. Because of it, all is as if Alice, by reconstructing Bob's choice, 
determined half of it. This retroaction of the output on the input is what al- 
lows the quantum algorithm to build up a stronger than classical input-output 
correlation - viz. the quantum speed-up. 

The plan of the paper is as follows: 

Section 3.1 Time- symmetric representation. We develop our explanation on 
Grover's algorithm. To the usual Alice's register, containing the number of the 
drawer that Alice wants to open, we add a Bob's register, containing the num- 
ber of the drawer with the ball. The initial state of Bob's register is maximally 
mixed, so that Bob's process of choice is represented from scratch; Bob measures 
the content of his register obtaining a drawer number at random - Figure 1. We 
assume that Bob's choice is this very number. The corresponding eigenstate, 
with the usual sharp state of Alice's register, is the input of the unitary part 
of the quantum algorithm U. Here, by performing function evaluations, Alice 
reconstructs Bob's choice in her register. By finally measuring the content of 
this register, she acquires the number of the drawer chosen by Bob, namely 
the solution of the problem. There is maximal quantum correlation between 
the result of the final measurement performed by Alice and that of the initial 
measurement performed by Bob; in fact the two measurements provide a com- 
mon, randomly selected, eigenvalue (Bob's choice). We will see that quantum 
correlation remains there also when Bob unitarily changes the initial random 
measurement outcome into a desired number. 

Section 3.2 Sharing the determination of Bob's choice. The fact that mea- 
suring an observable determines one of its eigenvalues is a postulate of quantum 
mechanics. However, this postulate gives room to an ambiguity. When two 
completely redundant measurements determine a common eigenvalue (here the 
number of the drawer chosen by Bob), which of the two measurements deter- 
mines it? Answering this question is instrumental to explaining the quantum 
speed-up. The idea that the determination should be ascribed to the measure- 
ment performed first does not seem to be justified. Because of redundancy, 
Bob's measurement can be suppressed and the determination of Bob's choice is 
performed by Alice's measurement, also at the time of the suppressed measure- 
ment. In fact, the projection of the quantum state due to Alice's measurement 
can be advanced at the time of the suppressed measurement along the unitary 
evolution between the two measurements (by the inverse of the time-forward 
evolution). Since either measurement determines Bob's choice, for reasons of 
symmetry we postulate that this determination shares evenly between the two 
measurements. This means that Alice's measurement contributes to the initial 
choice of Bob by determining half of it (n/2 of the bits that specify it in the 
case that Bob's choice is an unstructured n-bit string). This explains all the 
quantum speed-ups examined in this paper. 

Section 3.3 Advanced knowledge. The time-symmetric representation of the 
quantum algorithm has another important property. It can be seen as the usual 
representation, starting with a well determined choice of Bob, relativized to 



the observer Alice in the sense of relational quantum mechanics [6]. In this 
interpretation, the maximally mixed initial state of Bob's register physically 
represents Alice's initial ignorance of Bob's choice. By advancing the contribu- 
tion of Alice's measurement to the determination of Bob's choice to the time 
of this choice, the entropy of the initial state of Bob's register is halved. This 
means that Alice knows in advance half of the choice. 

Section 3.4 History superposition picture. Correspondingly, the quantum al- 
gorithm is a superposition of histories. In each of them, Alice knows in advance 
one of the possible halves of Bob's choice (n/2 bits) and performs the classi- 
cal computations required to identify the missing half. This requires O (2"/^) 
function evaluations against the O (2") of the classical case where Alice com- 
pletely ignores Bob's choice, what explains the quadratic speed-up of the present 
algorithm. 

Section 4 Mechanism of the quantum speed-up. The present explanation 
of the quantum speed-up allows us to pinpoint the exact mechanism of the 
quantum speed-up. Given any set of functions, this mechanism - under max- 
imization of a quantity of information - becomes the quantum algorithm that 
reconstructs Bob's choice with a quantum speed-up. Yielding a characteristic 
of the function chosen by Bob is a by-product of this reconstruction. 

Section 5 Deutsch&Jozsa's algorithm, Section 6 Simon's and the hidden sub- 
group algorithms. Here Bob's choice is a highly structured bit string. In all the 
cases examined, given the advanced knowledge of half of it, finding the miss- 
ing half requires a single function evaluation - against an exponential number 
thereof in the absence of advanced knowledge. This explains the exponential 
speed-up of these latter algorithms. 

Section 7 Conclusions. We summarize and discuss the results obtained. 

An earlier version of the present work has been presented at the 92""^ Annual 
Meeting of the AAAS Pacific Division [7] . With respect to the explanation of 
the speed-up provided in Ref. [8] , we have brought to the fundamental level the 
problem of sharing between Alice's and Bob's measurements the determination 
of Bob's choice. This has allowed us to extend that explanation to the entire 
family of quantum algorithms. 

3 Grover's algorithm 

We develop our argument in detail for the four drawer instance of Grover's 
algorithm. 

3.1 Time-symmetric representation 

We formalize the four drawer problem. Let b = feo&i and a = aooi € {00, 01, 10, 11} 
be the number of the drawer with the ball and respectively that of the drawer 
that Alice wants to open. Bob writes his choice of the value of b in a two-qubit 
register B. As we will sec, this register is indifferently real or imaginary. We 
take the expression " imaginary register" from reference [9] , which highlights the 



problem-solution symmetry of Grover's and the phase estimation algorithms. 
Alice writes a value of a in a two-qubit register A. Then a black box computes 
the Kronecker function (5(b,a), which gives 1 if b = a and otherwise - tells 
Alice whether the ball is in drawer a. A one-qubit register V is meant to contain 
the result of the computation of 5 (b, a) - modulo 2 added to its former content 
for logical reversibility. 

We assume that register B is initially in a maximally mixed state, so that 
the value of b is completely undetermined. Further below we will show that this 
assumption just yields a special view of the usual quantum algorithm (starting 
with the value of b completely determined). Registers A and V are prepared as 
required by Grover's algorithm. In the present time-symmetric representation, 
the initial state of the three registers is: 



1^) = ^ (e'^° |00)s + e^^^ 101)^ + e^^^- 110)^ + e^^^ \n)^) |00)^ (|0)^ - |1)^) , 

(1) 
For reasons of space, we use the random phase representation of a density op- 
erator - a formalism implicit in the random phase approximation [10]. The ipi 
are independent random phases, each with uniform distribution in [0,27r]. The 
density operator is the average over all (pi of the product of the ket by the bra: 

(1^) i^K^ = I (|oo)b (oo|s + 101)^ (011^ + 110)^ (101^ + 111)^ (111^) 

|00)^(OOU(|0)^-|l)^)((0|^-(l|^). (2) 

The von Neumann entropy of state ([T|) is two bits. 

Reading the content of a register amounts to measuring a corresponding 
observable. We call B {A) the content of register B (A), of eigenvalue b (a). 
B and A are both diagonal in the computational basis and thus commute. In 
order to prepare register B in the desired value of b, in the first place Bob 
should measure B in state ([T]). He obtains an eigenvalue at random, say b = 01. 
Correspondingly, state ^ is projected on: 

Ps|^) = ^|01)5|00)^(|0)^-|l)v.), (3) 

we denote projection operators by the letter P. For the time being, we assume 
that Bob's choice is random, is the result of measurement itself. The case that 
Bob chooses a predetermined value of b will be considered at the end of this 
section. 

State (jSj, with register i? in a sharp state, is the input state of the conven- 
tional representation of the quantum algorithm. For reasons that will become 
clear, we retard to the end of the unitary part of the quantum algorithm the 
projection of the quantum state induced by measuring B - as well known, such 
projections can be retarded or advanced along the unitary transformation after 
or before the measurement (by the way, retarding the projection is here equiva- 
lent to deferring the measurement itself). Thus, the input state of the quantum 
algorithm is state ([T]) back again. 



At this point, Alice applies the Hadamard transform Ua to register A: 

Ua IV) = ^ (e'^° 100)5 + ^''" |01)b + c"^' |10)b + e'^^ |11)b) 

(|00)^ + |01)^ + |10)^ + |11)^) (|0)^ - |1)^) (4) 

Then she performs the reversible computation of S (b, a), represented by the 
unitary transformation Uf {f like "function evaluation"): 



UfUA\i^)= ^ 



4V2 



(|0)y-|l) 



e^'^« 100)5 (- |00)^ + |01)^ + |10)^ + |11)^) + 

e'^^ 101)5 (|GG)^ - |G1)^ + |1G)^ + |11)^) + 

e'^^ 110)5 (|00)^ + |G1)^ - |1G)^ + |11)^) + 

c^'^3|n)^(|00)^ + |01)^ + |10)^-|ll)J 

(5) 
We can see that Uf maximally entangles registers B and A. Four orthogonal 

states of B, each a value of b, one by one multiply four orthogonal states of 

A. This means that the information about the value of b has propagated to 

register A. 

We should note that the entanglement in state ([5]) does not yet correspond 

to correlation between measurement outcomes - measuring B and A in this 

state (always in the computational basis) would yield uncorrelated outcomes. 

To make correlation of entanglement, we need to apply to register A the unitary 

transformation C/^ (the so called inversion about the mean): 

U'AUfUA IV) = ^ (e^'^" |0G)5 |00)^ + e^'^^ |01)5 |01)^ + e^^^ |10)5 |1G)^ + e^^^ |11)5 |11)^) 

(|0)y-|l)v), (6) 

In state (O, register A contains the solution of the problem - the value of b 
chosen by Bob. Alice acquires the solution by measuring A. This projects state 
© on: 

PaU'aUjUa W = ^ |G1)5 |01)^ (10)^, - 11)^,) . (7) 

We note that this projection coincides with the (retarded) projection due to 
the measurement of B in state ([ij . 

Equations ([1]) and (U) through ([7]) represent the quantum algorithm rela- 
tivized to the observer Alice in the sense of relational quantum mechanics. By 
the definition of the problem, the projection due to measuring B in state ([1]) 
should remain hidden to the observer Alice. It should in fact be retarded until 
Alice measures A in state ([6]). In view of what will follow, it is important to note 
that, in the relativized algorithm, the two bit entropy of state ([IJ represents Al- 
ice's initial ignorance of Bob's choice. When Alice measures A in state ©, the 
entropy of the quantum state becomes zero and Alice acquires full knowledge 
of Bob's choice. Thus, the entropy of the quantum state along the relativized 
algorithm gauges Ahce's ignorance of Bob's choice. 

We can see that there is quantum correlation between the outcome of mea- 
suring B in state ([T]) and that of measuring A in state ^. In fact the two 



measurements provide a common, randomly selected, eigenvalue (the value 01 
of both b and a, i. e. Bob's choice). As we will see, this quantum correlation 
plays a crucial role in the present explanation of the speed-up. 

Until now we have assumed that Bob's choice is a random measurement 
outcome. An equally crucial point of our argument is noting that quantum 
correlation remains there also when Bob chooses a predetermined value of b. 
Say that the measurement of B in state ^ yields b = 11 and Bob wants 
b = 01. He should apply to register B a permutation of the values of b, a 
unitary transformation Ub such that [/b|11)^ = |01)^. Then the algorithm 
proceeds as before. The correlation is the same as before up to the permutation 
Ub- The point is that, from the standpoint of quantum correlation, Ub should 
be considered a "fixed" transformation. 

In fact quantum correlation concerns two measurement outcomes in an en- 
semble of repetitions of the same quantum experiment, here consisting of the 
measurement of an observable in an initial state, a successive unitary trans- 
formation, and the measurement of another observable in the resulting state - 
Figure 1. Thus, initial state and unitary transformation should remain unal- 
tered throughout the ensemble of repetitions. In particular Ub, being part of 
the unitary transformation, should be considered the same in all repetitions. 

Thus, from the standpoint of quantum correlation, the predetermined value 
of b, being the fixed permutation of a random measurement outcome, is a 
random measurement outcome as well. The fact that Bob chooses Ub to always 
obtain b = 01, independently of the outcome of measuring B in state ([1]), is 
independent of quantum correlation. 

3.2 Sharing the determination of Bob's choice 

We want to share the determination of Bob's choice between Bob's and Alice's 
measurements . 

To start with, we introduce the ingredients required to perform the sharing. 

We call \ip) B the state of register B at the end of the unitary part of the 
algorithm, namely in state ([6]): 

IV')b = I (e^^" I00)s + e'^^ |01)b + e^^^ 110)^ -I- e^^^ 111)^) . (8) 

1^)^ is the random phase representation of the reduced density operator of 
register B: 

(I'^)b (V'Ib)v^. = I (|oo)s (ooIb + |oi)b (oi|b + |io>b (io|b + |ii)b (iiIb) • 

Incidentally, we note that the state of register B is the same in state ([1]) ; in fact it 
remains unaltered throughout the unitary part of the quantum algorithm which 
is the identity on it. £b, the entropy of |V')bi is two bits. The measurement of 
B reduces the entropy of both the state of register B and the overall quantum 
state by £b- 



The determination of Bob's choice is represented by Pb, the projection of 
\tp)g on |01)^ due to the measurement of the content of register B. We share 
the determination of Bob's choice by sharing Pb, what can be done by resorting 
to the notion of partial measurement of the content of B. 

We consider the following partial measurements and the corresponding pro- 
jections of \iP)b- The measurement of the content of the left cell of S - of the 
observable Bq of eigenvalue 60 • A-priori, the measurement outcome is either 
60 = or 60 = 1. However, in present assumptions, the measurement of B 
projects \iP)b '^^ |01)_B7 ^^ ^^^ ^^ f*<^t discussing how to share this projection. 
Thus we should assume that the measurement of Bq yields bo = 0, namely 
projects \ij)g on ^ (e*'^" lOO)^ +e^'^i |01)b); we also say "on b e {01,00}". 
Similarly, the measurement of the content of the right cell of B projects |V')b 
on b G {01, 11}, that of the exclusive or of the contents of the two cells projects 
|V')b on be {01,10}. 

We will see afterwards that Pb should be shared into any two of the three 
projections of |^)^ on: b e {01, 00}, b e {01, 11}, and b e {01, 10}. One share 
(either one) should be ascribed to the measurement of Bob, the other to that of 
Ahce. 

Until now we have introduced the tools to share the determination of Bob's 
choice between Bob's and Alice's measurements. Now we introduce some con- 
ditions that reasonably should be satisfied by the sharing. 

First, we get rid of all redundancy between the two measurements. We resort 
to Occam's razor; in Newton's formulation, it states " We are to admit no more 
causes of natural things than such that are both true and sufficient to explain 
their appearances^^ [11]. This requires that, together, the two shares of Pb (the 
corresponding partial measurements) tightly determine the value of b, namely 
without determining twice any Boolean function of b. This is condition (i) of 
the sharing rule. 

We apply it to Grover's algorithm. Here, the (more in general) n bits that 
specify the value of b are independently selected in a random way. Thus, condi- 
tion (i) requires that the determination of p of these bits (0 < p < n) is ascribed 
to the measurement of Bob, that of the other n — p bits to the measurement of 
Ahce. 

Condition (i) docs not constrain the value of p. This is up to the following 
condition (ii). Let Afg ' ( Af]j ') be the reduction of the entropy of the state 
of register B - and of the overall quantum state ~ associated with the share 
of Pb ascribed to Bob's (Alice's) measurement. Here we have A5]j ' ~ p, 
A£g ' = n — p. Since Bob's choice is determined by either Bob's or Alice's 
measurement, for reasons of symmetry we require: 

a4^'=a4^\ (9) 

Here this becomes p = n — p = n/2 - the n bits of £b share evenly between the 
two measurements. 

Although self evident, the sharing rule we are dealing with is axiomatic in 
character and thus open to criticism. However, the present work has an intrinsic 



redundancy. The mechanism of the quantum speed-up the sharing rule leads to 
holds per se, is a common pattern of all the quantum algorithms of the present 
family. Only the fundamental justification of this pattern relies on the axiomatic 
step. 

We can see that sharing Pb into any two of the above said three projections 
satisfies conditions (i) and (ii). In fact: (i) any pair of projections, corresponding 
to the measurement of a pair of observables among Bq, Bi, and Bx, tightly 
selects a value of b and (ii) any projection reduces the entropy of the state of 
register B of one bit, so that Eq. © is always satisfied. We can also see that 
there is no other way of satisfying the sharing rule. 

Sharing between the measurements of A and B the determination of Bob's 
choice is equivalent to saying that Alice's measurement of A contributes to this 
determination. Thus, in Grover's algorithm, Alice's measurement determines 
half of the bits that specify Bob's choice. 

This faces us with the problem that half of Bob's choice can be taken in 
many ways. A natural way of solving this problem is requiring that the sharing 
is done in a quantum superposition of the possible ways of taking half of the 
choice. This is condition (iii) of the sharing rule. We reconcile the quantum 
algorithm with this condition by assuming that it is a quantum superposition of 
algorithms (or " histories" ) , each characterized by a possible way of taking half 
choice. 

3.3 Advanced knowledge 

We show that ascribing to Alice's measurement the determination of part of 
Bob's choice implies that Alice knows in advance, before running the algorithm, 
that part of the choice. 

We work on an example. We ascribe to Alice's measurement the determina- 
tion 60 = - namely the projection of state ([6]) on: 

1 

2 

To be seen as a contribution to Bob's choice, this projection should be advanced 
to the time of Bob's choice - see Figure 1. To this end, we apply U\ulu'2 to 
the two ends of it, namely to states (O and ((TU]). This yields the projection of 
the input state of the quantum algorithm ([Ij on: 

i (e^^« 100)5 + ^"'' I01)s) |00)a (I0)y - |l)v) • (11) 

Thus, the entropy of the state of register B in the input state of the quantum 
algorithm is halved. Since this entropy represents Alice's initial ignorance of 
Bob's choice (Section 2.1), this means that Alice, before running the algorithm, 
knows n/2 of the bits that specify Bob's choice, here one bit - in fact 60 — 0. 
We are at the level of elementary logical operations where knowing is doing. 
" Doing" means identifying the missing half of the choice with a single compu- 
tation of S (b, a). This fits advanced knowledge and explains the speed-up from 
three to one computation. 



s'^° 100)5 |00)^ + e'^^ 101)5 |01)^) (|0)^ - |1)^) . (10) 



3.4 History superposition picture 

We show that Grover's algorithm is a quantum superposition of histories; in 
each of them, given the advanced knowledge of one bit of Bob's choice, Alice 
classically computes the missing bit. 

Let us assume that Bob's choice is b = 01. As we have seen in Section 
2.2, Alice's advanced knowledge can be: b G {01,00}, or b e {01,11}, or 
be {01, 10}. 

We start with the first possibility. Given the advanced knowledge of b S 
{01, 00}, to identify the value of b Alice should compute S (b, a) (for short "(5") 
for either a = 01 or a = 00. 

Let us assume it is for a = 01. The outcome of the computation is (5 = 1, 
which of course tells Alice that b = 01. This corresponds to two classical com- 
putation histories, one for each possible sharp state of register V: we represent 
each classical computation history as a sequence of sharp quantum states. 

The initial state of history 1 is e'^^ |01)s |01)^ \0)y. The product |01)b |01)^ 
means that the input of the computation of (5 (b, a) is b = 01, a = 01; \0)y is one 
of the two possible sharp states of register V. The state after the computation 
of S is e^'^i |01)_B |01)a \^)v ~ ^^^ result of the computation is modulo 2 added 
to the former content of register V. We are using the history amplitudes that 
reconstruct the quantum algorithm; our present aim is to show that the quantum 
algorithm is a superposition of histories whose computational part is classical. 

By the way, history amplitudes - in equivalent terms the state of registers A 
and 1/ in (JH) - can also be found from scratch by starting with a generic state 
of the two registers and then setting the amplitudes in such a way that the 
entanglement between registers B and A (or the entropy of the state of register 
A) after the first computation of S is maximized - see Ref. [8] . 

In history 2, the states before/after the computation of (5 are — e"^^ |01)b |01)^ 

In the case that Alice computes 6 (b, a) for a = 00 instead, she obtains 
6 = 0, which of course tells her again that b = 01. This originates other two 
histories. History 3: e**^! lOl)^ |00)^ |0)^ -)■ e'^^ lOl)^ |00)^ |0)^; history 4: 
- e^^^ 101)^ |00)^ |1)^^ ^ - e^^i 101)^ |00)^ |1)^. _ 

We develop in a similar way the other histories. The computation step of 
Grover's algorithm, namely the transformation of state (j4|) into state ([5]), is the 
superposition of all these histories. 

At this point we perform a non-computational step (the inversion about the 
mean) by applying the unitary transformation C/^ to register A. This branches 
each history into four histories; the end states of such branches interfere with 
one another to give state (O. 

Summing up, Grover's algorithm for n = 2 can be decomposed into a su- 
perposition of histories which start from Alice's advanced knowledge and whose 
computational part is entirely classical. 

Let us now consider the case n > 2. As well known, the sequence "function 
evaluation-inversion about the mean" (the algorithm's iterate) should be iter- 
ated ^2"/^ times. This maximizes the probability of finding the solution leaving 
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a probability of error < ^ . This goes along with the present explanation of the 
speed-up in the order of magnitude. In fact, according to it, one should per- 
form O (2"/^) computations oi S - this is the number of classical computations 
required to find the missing half of Bob's choice given the advanced knowledge 
of the other half. 

4 Mechanism of the quantum speed-up 

The present explanation allows us to pinpoint the exact mechanism of the quan- 
tum speed-up. We represent this mechanism by means of a generalized quantum 
algorithm that, given any set of functions and under maximization of a quantity 
of information, becomes the quantum algorithm that yields with a speed-up a 
characteristic of the function chosen by Bob. 

We start from some set of functions /b (a) , where b is a bit string ranging 
over some set of values. In the case of Grover's algorithm, this is the set of all 
the /b (a) = 6 (b,a) for b e {0, 1}". Register B contains b, the label of the 
function chosen by Bob, register A the argument of the function, and register V 
the result of function evaluation reversibly added to its former content. As we 
will see, the problem solved by the generalized algorithm should be identified 
a-posteriori. The algorithm is: 

(I) Assume that i? is in a maximally mixed state, prepare A and V in such a 
way that the entanglement between B and A after the first function evaluation 
is maximum. In equivalent terms the entropy of the state (i. e. of the reduced 
density operator) of register A should be maximized. 

(II) Perform function evaluation. Since the state of register B remains unal- 
tered throughout the unitary part of the algorithm, the creation of entanglement 
between B and A means that information about the content of B leaks to A. 
The amount of the information leaked is the entropy of the state of register A. 
The information is naturally about some characteristic of /b (a) - the value of 
b in Grover's algorithm or something related to the period of the function in 
the algorithms of Simon and Shor. 

(III) Apply to ^ a unitary transformation that makes correlation of entan- 
glement. Points (II) and (III) constitute the algorithm's iterate. 

(IV) Let Af be the number of function evaluations required to classically de- 
termine Bob's choice given the advanced knowledge of the part of it established 
by the sharing rule. Perform the iterate O (Af) times. This makes the character- 
istic of /b (a) , itself a function of Bob's choice, determined in all the quantum 
algorithms examined in this paper. We incidentally note that, since the present 
maximization procedure completely defines each iteration of the quantum algo- 
rithm, the number of function evaluations required to obtain the solution with 
a desired probability could also be found analytically. 

(V) Acquire the characteristic by measuring A. 

Thus, the problem solved by the algorithm is finding the characteristic of 
the function that leaks to register A with function evaluation. Solving this 
problem is a by-product of reconstructing Bob's choice. In Ref. [8], by way 



11 



of exemplification, we had provided a new quantum speed-up. This speed-up, 
given the set of functions considered in [8], is automatically generated by the 
present mechanism. 

It should also be noted that the generalized algorithm sharply diverges from 
Grover's algorithm if we iterate beyond O (A/"). Having replaced the inversion 
about the mean by the transformation that makes correlation of entanglement, 
it is never the case that we unentangle registers B and A. For example, in the 
case n = 2, this latter transformation is exactly the inversion about the mean 
at the first iteration and becomes the identity if we iterate more than once. 

5 Deutsch&Jozsa's algorithm 

In Deutsch&Jozsa's [12] algorithm, the set of functions known to both Bob and 
Alice is all the constant and balanced functions (with an even number of zeroes 
and ones) /b : {0, 1}" -^ {0, 1}. Array (fT2|l gives this set for n = 2. 



a 


/oooo (a) 


/nil (a) 


/ooii (a) 


/iioo (a) 


/oioi (a) 


/loio (a) 


/oiio (a) 


/looi (a) 


00 





1 





1 





1 





1 


01 





1 





1 


1 





1 





10 





1 


1 








1 


1 





11 





1 


1 





1 








1 



(12) 
The string b = 5o, bi, ..., 62"-i is both the suffix and the table of the func- 
tion - the sequence of function values for increasing values of the argument. 
Specifying the choice of the function by means of the table of the function sim- 
plifies the discussion. Alice is to find whether the function selected by Bob is 
balanced or constant by computing /b (a) = / (b, a) for appropriate values of a. 
In the classical case this requires, in the worst case, a number of computations 
of / (b, a) exponential in n; in the quantum case one computation. 

5.1 Time symmetric representation 

In the time-symmetric representation, the input and output states of the quan- 
tum algorithm are respectively: 



1 



(e^^" |0000)b + e'^i lllll)^ + e'^= lOOll)^ + e'^^ |1100)s + ...) |00)^ (|0)^ - |1)^) ., 

(13) 



UAUfUA W = - [(e^*^" 10000)5 - e^'^^ 11111)5) |00)^ + (e^^^ lOOll)^ - e^^^ IllOO)^) |10)^ + 



(|0)v-|l)y). 



(14) 



Ua is the Hadamard transform on register A, Uj is function evaluation, namely 
the computation of /(b,a). Measuring B in state (fT3)) yields Bob's choice, a 
value of b. Measuring A in state (fT4)) yields the solution: "constant" if a is all 
zeros, "balanced" otherwise. 
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This time the solution found by Alice is a function of Bob's choice with 
a lower information content. However - as we will see - this solution is still 
a by-product of Alice's reconstruction of Bob's choice. This can be explicitly 
represented by adding an imaginary register V of the same size of B. The black 
box, besides reversibly writing in V the result of function evaluation, should 
reversibly write in V the corresponding reconstruction of Bob's choice. States 
(fT3|) and (|14p are replaced by 



i (e^'^" |0000)s + e'^^ lllll)^ + ...) [0000)^ |00)^ (|0)^ - |1)^) (15) 
and 

i [e^^«(|0000)5 10000)^ - e^^^ lllll)^ |1111)^) |00)^ + ...] (|0)^ - |1)^) . 

(16) 
Since all computations are logically reversible, there is certainly a unitary trans- 
formation that (with one function evaluation) sends state (fT5|) into (fT6|) . 

5.2 Sharing the determination of Bob's choice 

We should think that Alice, besides A, also measures V - the content of register 
V. At this point we can share the determination of Bob's choice between the 
measurement of B and that of V exactly as we did for Grover's algorithm. The 
fact that the measurement of V is an imaginary operation is irrelevant; retro- 
causality serves in fact to highlight the mechanism of the quantum speed-up 
hosted in the unitary part of the algorithm. 

The state of registers B in the overall state (fT4|) is: 

Wb = ^ i^'"" 10000)^ + e*'^^ |llll)s + e^^= lOOll)^ + e'^^ IllOO)^ + ...) . 

(17) 
We assume that Bob's choice is b = 0011. Pb is the projection of \ip)g on 
|0011)^. £b is the (three bit) entropy of \tp) g- It is zeroed by the measurement 
of either ij or V. 

To share Pb, wc consider the "elementary" one-bit observables Bi, with 
i G {0,1}". The measurement of each Bi yields the value the i-th bit of the 
bit string b, namely of the i-th row of the table of the function (as for point 1 
of Section 2.2, measurement outcomes are post-selected to match with the bit 
string) . Now that b is structured we do not need to consider Boolean functions 
of the Bi - we will see that all the histories are generated without such dependent 
observables (considering also these observables would simply generate repeated 
histories). 

Let us call PB^i the projection of 1^)^ associated with the measurement of 
Bi. Since each share of Pb is an aggregate of the PB,i, it is completely defined 
by the share of the table on which it projects. Thus, we should take two shares 
of the table such that the projections on them satisfy the sharing rule. 
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As shown below, the sharing rule implies that the two shares are two com- 
plementary half tables in each of which all the values of the function are the 
same. We call each share of this kind a good half table. 

For example in the case b — 0011, these two shares are: /b (00) = 0, /b (01) = 
and /b (10) = 1, /b (11) = 1. The corresponding shares of Pb are the projec- 
tions of IV')^ on b e {0011,0000} and respectively b € {0011, 1111}; we have 
A5^ ' — A£^ ' — 2 bit, what satisfies Eq. ^. One projection (either one) is 
ascribed to the measurement of B, the other to that of V. This latter projection 
becomes Alice knowing in advance the good half table. 

We can see that this is the only way of satisfying the sharing rule. If one 
half table is not good (the values of the function are not all the same), because 
of the structure of the table, also the other half would not be good. Thus, the 
two corresponding shares of Pb would both determine the fact that the function 
is balanced, namely a Boolean function of b. This would violate the no over- 
determination condition of the sharing rule. If one or both shares were less than 
half table, this would either not satisfy Eq. © or not determine the value of b, 
as readily checked. 

5.3 Advanced knowledge 

Besides Alice's contribution to Bob's choice, a good half table represents Al- 
ice's advanced knowledge of Bob's choice. In fact, since the state of register B 
remains unaltered throughout the unitary part of the quantum algorithm, also 
its projection on the half table remains unaltered. At the end of the unitary 
part of the algorithm, this projection represents Alice's contribution to Bob's 
choice. Advanced at the beginning, it changes Alice's complete ignorance of 
Bob's choice into knowledge of the half table. 

It is immediate to check that the quantum algorithm requires the number 
of function evaluations of a classical algorithm that has to identify Bob's choice 
starting from the advanced knowledge of a good half table. In fact, the value 
of b (and the solution of the problem) can be identified by computing /b (a) 
for only one value of a (anyone) outside the half table. Thus, both the quan- 
tum algorithm and the advanced knowledge classical algorithm require just one 
function evaluation. 

5.4 History superposition picture 

It is convenient to group the histories with the same value of b. Starting 
with b = 0011, we assume that Alice's advanced knowledge is, e. g., b S 
{0011,0000}. In order to determine the value of b and thus the character of 
the function, Alice should perform function evaluation for either a = 10 or 
a = 11. We assume it is for a = 10. Since we are under the assumption 
b = 0011, the result of the computation is 1. This originates two classical 
computation histories, each consisting of a state before and one after function 
evaluation. History 1: e*^^ |0011)b |10)^ |0)y ^ e*^^ lOOll)^ |10)^ |1)^. His- 



14 



tory 2: - e-^MOOll)^ |10)^ |1) 



-c'^P^ 10011)5 |10)^ |0)^. If she performs 



function evaluation for a = 11 instead, this originates other two histories, etc. 

As readily checked, the superposition of all these histories is the function 
evaluation stage of the quantum algorithm. Then, Alice applies the Hadamard 
transform to register A. Each history branches into four histories. The end 
states of such branches interfere with one another to yield state ([H]) . 

We can see that the present quantum algorithm conforms to the generalized 
algorithm. In each history, Alice performs the computations required to deter- 
mine Bob's choice (which means just one function evaluation). The solution of 
Deutsch&Jozsa's problem is a by-product of this determination. 

It is easy to see that the present analysis holds unaltered for n > 2. 



6 Simon's and the hidden subgroup algorithms 

In Simon's [13] algorithm, the set of functions is all the /b : {0, 1}" — >■ {0, 1}"~ 
such that /b (a) — /b (c) if and only ifa = cora = c© h'^*') ; © denotes bitwise 
modulo 2 addition; the bit string h^''^ depending on b and belonging to {0, 1}" 
excluded the all zeroes string, is a sort of period of the function. Array (|18p 
gives the set of functions for n = 2. The bit string b is both the sufhx and the 
table of the function. Since h^*^) © h'^'') = (the all zeros string), each value of 
the function appears exactly twice in the table, thus 50% of the rows plus one 
always identify h^''^ 





h(ooii) ^ 01 


h(iioo) ^ 01 


h(oioi) = 10 


h(ioio) ^ 10 


hCOiio) ^ 11 


h(iooi) ^ 11 


a 


/ooii (a) 


/iioo (a) 


/oioi (a) 


/loio (a) 


/ouo (a) 


/looi (a) 


00 





1 





1 





1 


01 





1 


1 





1 





10 


1 








1 


1 





11 


1 





1 








1 



(18) 
Bob selects a value of b. Alice's problem is finding the value of h^''^ "hid- 
den" in /b (a), by computing /b (a) = / (b, a) for different values of a. In 
present knowledge, a classical algorithm requires a number of computations of 
/ (b, a) exponential in n. The quantum algorithm solves the hard part of this 
problem, namely finding a string s^- orthogonal to h^^', with one computation 
of /(b,a); "orthogonal" means that the modulo 2 addition of the bits of the 
bitwise product of the two strings is zero. There are 2"~^ such strings. Run- 
ning the quantum algorithm yields one of these strings at random (see further 
below). The quantum algorithm is iterated until finding n — 1 different strings. 
This allows us to find h^''^ by solving a system of modulo 2 linear equations. 

6.1 Time symmetric representation 

In the time-symmetric representation, the input and output states of the quan- 
tum algorithm are respectively: 
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1^) = ^ (e'^" 10011)5 + e'^^ 11100)5 + e'^^ |0101)b + e^'"^ IIOIO)^ + ...) |00)^ |0)^ , 

(19) 

UAUfUA m = 

1 r (e^-^o 10011)^ + e»^MllOO)B)[(|00)^ + |10)^)|0)^ + (|00)^-|10)^)|l 



2V6 I (e^*^^ |0101)b + e^'^3 |ioio)^) [(|00)^ + |01)^) |0)^ + (|00)^ - |01)^) |1)^] - 

(20) 

In state p9)) . register V is prepared in the all zeros string (just one zero 

for n = 2). State ([20| is reached with a single computation of /(b,a). In 

state ([20l) . for each value of b, register A (no matter the content of V) hosts 

even weighted superpositions of the 2""^ strings s, orthogonal to h'^'^^ By 



= (b) 



measuring A in this state, Alice obtains at random one of the s- ' . Then she 
iterates the "right part" of the algorithm (preparation of registers A and V, 
computation of / (b, a), and measurement of A) until obtaining n — 1 different 

(b) 

By the way, Alice should throw away all the measurement outcomes where 
the value of a is GO: such outcomes are completely uncorrelated with the value 
of b - see Eq. (^0)) - are thus cases where the quantum algorithm fails. We 
note that the probability of getting the measurement outcome a = 00 is 1/2""-'^. 
From now on we consider this "post-selected" quantum algorithm. 

6.2 Sharing the determination of Bob's choice 

Also in the present case the solution of the problem is a by-product of recon- 
structing Bob's choice. The analysis is completely similar to that of Section 
5.2. 

We assume that Bob's choice is b = 0011. Pb is the projection of l^)^ 
on 10011)5. The shares of Pb are still defined by the shares of the table 0011 
on which they project. This time a good half table should not contain a same 
value of the function twice, what would over-determine h^*^', namely a Boolean 
function of b (because of the structure of the table, also the other half would 
contain a same value twice). There are two ways of sharing the table 0011. One 
is /b (00) = 0, /b (10) — 1 and /b (01) = 0, /b (11) = 1; the corresponding shares 
of Pb are the projections of \'i))^ on b e {0011, 0110} and b e {0011, 1001}, see 
array dUl). The other is /b (00) = 0, /b (11) = 1 and /b (01) = 0, /b (10) = 1, 
etc. 

By the way, we should note that sharing each table into two halves is acci- 
dental. In the quantum part of Shor's [14] factorization algorithm (finding the 
period of a periodic function), taking two parts of the table that do not contain 
a same value of the function twice implies that each part is less than half table 
when the domain of the function spans more than two periods. 
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6.3 Advanced knowledge 

Back to Simon's algorithm, we can see that it requires the number of function 
evaluations of a classical algorithm that knows in advance a good half table. In 
fact, since no value of the function appears twice in the half table, the value of 
b is always determined by computing / (b, a) for only one value of a (anyone) 
outside the half table - see array (TTSl) . Thus, both the quantum algorithm and 
the advanced knowledge classical algorithm require just one function evaluation. 

6.4 History superposition picture 

The history superposition picture can be developed as in Section 4.4: given the 
advanced knowledge of, say, b S {0011,0110}, in order to determine the value 
of b, Alice should perform function evaluation for either a = 01 or a= 11, etc. 

The present analysis holds unaltered for n > 2. It also applies to the gen- 
eralized Simon's problem and to the Abelian hidden subgroup problem. In fact 
the corresponding algorithms are essentially the same as the algorithm that 
solves Simon's problem. In the hidden subgroup problem, the set of functions 
fb'.G—i'W map a group G to some finite set W with the property that there 
exists some subgroup S < G such that for any a, c e G, /b (a) — /b (c) if 
and only ifa+S* = c-t-^*. The problem is to find the hidden subgroup S by 
computing /b (a) for various values of a. 

Now, a large variety of problems solvable with a quantum speed-up can be re- 
formulated in terms of the hidden subgroup problem [15]. Among these we find: 
the seminal Deutsch's problem, finding orders, finding the period of a function 
(thus the problem solved by the quantum part of Shor's factorization algorithm), 
discrete logarithms in any group, hidden linear functions, self shift equivalent 
polynomials, Abelian stabilizer problem, graph automorphism problem. 

7 Conclusions 

The time-symmetric representation of quantum algorithms shows that the so- 
lution of the problem on the part of Alice is a by-product of her reconstruction 
of Bob's choice. Because of maximal quantum correlation between Bob's choice 
and its reconstruction, all is as if Alice, by reading the reconstruction at the 
end of the algorithm, determined half of Bob's choice. This quantum retroac- 
tion of the output on the input explains the quantum speed-up, the fact that 
quantum algorithms create a stronger than classical input-output correlation. 
This finding: 

(I) Allows us to pinpoint the exact mechanism of the quantum speed-up. 
Given a set of functions and under maximization of a quantity of information, 
this mechanism generates the quantum algorithm that finds with a speed-up a 
characteristic of the function chosen by Bob. The number of function evalua- 
tions is that required to classically determine Bob's choice given the advanced 
knowledge of half of it. This should be a break through, until now there was no 
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known mechanism for producing speed-ups. In hindsight, we can see that the 
new speed-up provided in Reference [8] is generated by this mechanism. 

(II) Highlights an essential difference between quantum and classical causal- 
ity, showing that causal quantum processes can host a loop of classical causal- 
ity. The causal quantum process is for example the transformation of |^) = 
^ 101)^ |00)^ (10)^, - 11)^,) into U'^UfUA I*) = ^ 101)5 |01)^ (10)^- - |l)v.) " 
equations ^ and ((T)) of Grover's algorithm. This transformation is a quantum 
superposition of classical computation histories. In each of them, Alice knows in 
advance half of Bob's choice and solves the problem more quickly by computing 
only the missing half. This partial knowledge of the result of a computation be- 
fore performing it (a causality loop) would be impossible if histories were isolated 
with respect to one another. However, this impossibility argument cannot be 
applied to the present case. In the superposition of all histories, the half choice 
known in advance in one history becomes the missing half in another one, where 
it is computed. Thus, all the possible halves of Bob's choice are computed, in 
quantum superposition. Moreover, histories are not isolated with respect to one 
another, as quantum interference provides cross talk between them. The fact 
that the interplay between quantum superposition and interference can origi- 
nate loops of classical causality is what explains the quantum speed-up at a 
fundamental physical level. In particular, it explains why quantum algorithms 
can violate a limit demonstrably applying to any classical process. 

One can envisage two directions of further research. One is the search for 
new quantum speed-ups. Under the above said mechanism, the question be- 
comes whether there are sets of functions that provide practically interesting 
speed-ups beyond those already discovered. The second one is the possibility 
of extending the present explanation of the speed-up to other classes of quan- 
tum algorithms. As it is, the explanation applies to problem-solving, it requires 
seeing a problem in the input of the quantum process and the solution of the 
problem in the output. This can be difficult in the quantum algorithms based 
on random walks or in mixed state quantum computing. In some cases, the 
quantum speed-up is only visible in the fact that the classical simulation of the 
input-output process requires a higher amount of computational resources. In 
order to apply the present explanation to these latter algorithms, we should 
decouple it from problem-solving. We note that the kernel of the explanation 
already is decoupled, is the fact that the quantum retroaction of the output 
on the input allows the creation of an input-output correlation stronger than 
what is classically possible. One can conjecture that this quantum retroaction 
mechanism stands at the basis of any quantum speed-up. 
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